*Actual Unicorn*. Blue Team, Detection Engineering. and SecOps Use Cases are my Jam.
United States (!Art Bell)
Joined July 2014
- Tweets1K
- Following229
- Followers676
- Likes584
There is a growing list of Shell and PowerShell Incident Response scripts in Blue Team Handbook here
github.com/DonMVB/BlueTeam-H…
There is a growing wiki for the Blue Team Handbook here
donmvb.github.io/
Along with a update to the Blue Team Handbook Incident Response, there is a growing code base available from the book on GitHub.
github.com/DonMVB/BlueTeam-H…
Version 3.0 of Blue Team Handbook, Incident Response Edition, is locked at loaded for a DEC 15 relese. Just looked through the proof copies. And the updated cover is a pure delight.
My graphic artist and I spent 7 hrs in the ER a week ago, redrawing it.
This reminds me of the chapter in Perfect Dark Initial Vector by Greg Rukka when the corpsec agent busts the Benjamin Able who is leaking data to the Carrington Institute.
Blue Team Handbook Incident Response is getting an update. Eight of ten chapters in the review pipeline. Should be ready for purchase for the Christmas 2025 season. OH - and there will be a wiki w/ tutorials and some pretty good #incidentresponse code.
github.com/DonMVB/BTHbIR/wik…
Looking forward to teaching #sec530 so I can help raise up the next round of #allaroundefenders and #blueteam security architects/engineers.
This is very, very well deserved. @MarkBaggett is one of the top leaders in our profession.
Heard on a call this morning. "well, its running on this poverty pony server ..." referring to a 7+ yr old 8 core box ...
Always looking to #sharpenthesaw … I'm listening to Finchwood Discipleship Podcast | How to Manage Your Time God’s Way (Season 3, Episode 11) on Podbean, check it out!
Some hash tags … #christian #bible podbean.com/ei/pb-yqjkk-1407…
Check your DNS traffic and security stack for these domains ...
⚠️ THREAT INTEL ALERT: Infoblox #ThreatIntelligence Group discovered new, low-profile malware DNS beacons communicating with a Russian C2. Here are the domains:👇
claudfront[.]net, allowlisted[.]net, atlas-upd[.]com, ads-tm-glb[.]click, cbox4[.]ignorelist[.]com, hsdps[.]cc
Skimmed the reference doc on @Microsoft #PKI - solid intro. Lots of good details in here.
After working with MSExchange and IIS components, I became interested in Certificate Services. Defending against Certificate Services abuse caught my attention: splunk.com/en_us/blog/securi…
I delved into the Certified Pre-Owned work (specterops.io/wp-content/upl…), which is a 143-page report that covers ADCS in-depth. Although the report was comprehensive, I noticed some areas that could benefit from better detection.
As a result, I wanted to provide defenders with a way to:
- Simulate adversary behavior with #AtomicRedTeam
- Know what and how to log
- Detect ADCS abuse
I hope you find this information interesting and helpful in learning something new!
Hey #authors / #selfpublishing ppl - is there a self publishing house that can watermark a PDF at point of sale w/ the end user's email address? Looking for some minimal protection. Yes, I know that qpdf can strip this out.
Dropped two CFP's down for two SANS Summits today. Churning on more ...
moowwaaahaaaaa!!!
@PSYber_Jen / @SANSDefense
New term: "con-dol-u-la-tions". Recently heard when a colleague has a coworker depart for greener pastures, and the colleague became the point person for a new tech platform they weren't familiar with.
I will be at RSAC 2023 for conversation around Cyber Threat Intel, network defense, applying DNS to improve your security posture, data exfiltration, ...
Bonus - if you have a Blue Team Handbook, my pen is will be nearby.
This event is worth carving out so,e time to attend.
Big news for the SOC folks out there! The Blueprint podcast will soon be releasing an entire special season with the authors of MITRE's "11 Strategies of a World-Class Cybersecurity Operations Center"! Subscribe now so you don't miss it! sans.org/blueprint #cybersecurity
